dependabot / dependabot/dependabot-core

Request: Update both the software version and the os version where both are present (in Docker image tags)

Open
#4,329 4 comments 15 reactions 0 assignees View on GitHub
L: docker T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

We have Docker images which use node and look like the following.
```dockerfile
FROM node:14.18.0-alpine3.12
```

We use Dependabot to keep said image up-to-date. So for example, Dependabot will create a PR that updates this to:
```dockerfile
FROM node:14.18.1-alpine3.12
```
since that is the latest version of node 14 (we have an ignore rule for major versions greater than v14).

However, at present Dependabot doesn't appear to update the base OS. In this case, we would like Dependabot to also bump alpine when new releases become available. In this case I would want Dependabot to update `alpine3.12` to `alpine3.14` (the current release). The end result would be
```dockerfile
FROM node:14.18.1-alpine3.14
```

(Apologies if this has already been requested, I couldn't find it when I searched)

Contributor guide

Open the contributing guide

Research direction

Start with the Dockerfile example and review how Dependabot handles versioned Docker image tags in FROM instructions. Reproduce the node:14.18.0-alpine3.12 case and determine how both the node and Alpine components should be selected while respecting the major-version ignore rule. Done means an update can produce node:14.18.1-alpine3.14 when both versions have newer releases.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
devops, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.